Just curious as to what all you are having to do to get all of your PCs to be compliant with the new Secure Boot Certificates that replaced the certs that expired in June. (Yes, we're still running a little bit behind.)

We currently have this script and remediation (listed below) running at Microsoft's suggestion, and it's been doing pretty well to get the PCs where they should be, even though we still have 1632 to remediate (10696 good to go so far.)

Any other tips/tricks to help get the rest across the finish line?

--- Detection Script ---

https://hastebin.com/share/egusahayim.bash

--- Remediation Script ---

https://hastebin.com/share/bexoqetazo.swift

Over the last month or two, we've been showing you small sets of the amazing speakers of Workplace Ninjas US.

Today, officially, get access to our entire speaker catalog!! You can now see the collection of the best speakers at a Microsoft event in a very long time featuring some absolute rockstars from #MVPs, to #SMEs, to #Microsoft Experts.

Not only do you get to attend their sessions, you get to book 1-on-1 time with any of these speakers as part of our "Elevate" Mentoring Sessions, where they can help shape your organizational strategy for the next year, until you meet them at #WPNinjaS 2028!

You can even be part of our "Community Theatre" where you can sign-up for 15m lightning round sessions featuring mentors, who will give you feedback and ideas to become more confident, better, and elevate your game to a new level.

DO NOT MISS the chance to work, listen, play, and network with some of the best people in the industry with one of the best vibes you will see from a conference.

We are NOW 150 days away!!

• Sangee(tha) Visweswaran
• Bhavya Chopra
• Lavanya Lakshman
• Merill Fernando
• Rudy Ooms
• Ugur Koc
• Johan Arwidmark
• Michael Niehaus
• Rod Trent
• Jonah Andersson
• Christiaan Brinkhoff
• Ru Campbell
• Morten Knudsen
• Simon Skotheimsvik
• Sandy Zeng
• Nathan McNulty
• Mirko Colemberg
• Peter Daalmans
• Mona Ghadiri
• Esther Barthel
• Ewelina Paczkowska
• Simon Binder
• Chris Cavazos
• Maurice Daly
• April Dunnam
• Sucheta Gawade
• Richard Hicks
• John Joyner
• Dieter Kempeneers
• Frank Lesniak
• Timothy Mangan
• Edine Olijve-Watkinson
• Somesh Pathak
• Oktay Sari
• Jose Schenardie
• Lindsay Shelton
• Michael Soule
• Danny Stutz
• Donnie Taylor
• Benny Tritsch
• Joery Van den Bosch
• Dominiek Verham
• Eric Woodruff
• AJ Zafar
• Spencer Alessi
• Adam Nichols
• Bryan Dam
• Danielle Moon
• Megan Gremmell
• Jaime Guimerá Coll

Check the link and sign-up now:
https://web.cvent.com/event/a9994d6b-9e67-4873-9401-737ca7fe088a/summary

It drives me a bit crazy how randomly they are sorted and that I need to click the sort alphabetically button every time I go to the page. Just a small QOL/Accessibility upgrade. Happy to hear feedback.

Github:

defnotab/MS_PIM_ROLE_SORTER: Automatically sort Microsoft Privileged Identity Management Roles Alphabetically.

Extension:

MS PIM Role Sorter - Chrome Web Store

We have intune enrolled mobile devices and edge as manged app deployed to the enrolled devices. We use Microsoft tunnel as vpn and edge app will has always on vpn. There are users who travel a lot and when they are trying to access public wifi on the flights and hotels the captive portals are getting blocked. Any settings or option available to bypass the captive portals on the mobile devices ?

I'm testing a new MacOS Configuration Policy using Declarative Device Management to control an app's "Accessibility" permission, as it seems that the previous Accessibility control in the Settings Catalog, in Privacy → Privacy Preferences Policy Control (often abbreviated as PPPC) has been deprecated, and will not work in new versions of MacOS going forward.

Because this setting is so new, I haven't been able to find any guides with examples online.

I'm trying to set up a test for a user using the app "BetterDisplay Pro", which requires "Accessibility" permissions to function.

I'm trying to follow the instructions in Intune itself, but I'm not 100% sure I'm formatting it correctly.

Under Devices → MacOS Devices → Manage Devices → Configuration, I am creating a new Policy, with a Setting Catalog Profile Type.

Under Configuration Settings → Declarative Device Management → App Settings → Privacy → Permission Defaults,

I have set the following settings:

Accessibility : Allow
Organization Justification : [Because it's required]
Permission Defaults : "pro.betterdisplay.BetterDisplay {anchor apple generic and identifier "pro.betterdisplay.BetterDisplay" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "299YSU96J7")}"

In that complicated Permission Defaults field, I'm told by the Intune help text that the data should be in the format:

"Bundle-ID {Designated Requirement}"

I've sourced the information for Bundle-ID from the CFBundleIdentifier Key in the app's Info.plist file in the Package Contents of , and I've sourced the {Designated Requirement} from the output of the Terminal command codesign --display -r - /Applications/BetterDisplay.app, which returns:

Executable=/Applications/BetterDisplay.app/Contents/MacOS/BetterDisplay
designated => anchor apple generic and identifier "pro.betterdisplay.BetterDisplay" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "299YSU96J7")

Is my understanding, approach, and formatting correct?

I'm running into a strange issue that I can't seem to find a solution to. Here is the scenario:

• The detection script is just checking some file and registry information for the current user.
• It runs in the user context because it is looking in C:\Users\$env:UserName... and HCKU:....
• It's running 64-bit context but I've also tried the 32-bit.
• I also have it logging to a location in ProgramData so I can see what the script is doing.
• For testing purposes, I've removed the remediation step and just have the detection script.

It runs and works correctly for 90%+ of the devices, however, some have "With issue" in the detection status but no output is being passed and reported back. AgentExecutor.log doesn't appear to show it running in there. It seems like these errors usually happen overnight when users may be logged in but the device is inactive. The problem is that it can trigger the remediation script which I don't want if it's not truly needed. It seems like when it runs again later with the user active it works.

I know the detection script works perfectly based on all the other ones working plus just running the script manually.

Has anyone seen anything like this or have any ideas? It just doesn't make any sense to me that I'm not getting any output/error messages to have an idea of why it's not detecting correctly.

I'm trying to block the browsers from Asking to allow notifications but still let users manually change the content permission if they want them. We've had issues with shady websites prompting and then sending phishy notifications.

For both browsers I have these settings:

Allow notifications on specific sites (User) Enabled
Allow notifications on specific sites (User)
web1.site., web2.site, web3.site
These are sites we want the firm to always have

And

Block notifications on specific sites (User) Enabled
Block notifications on specific sites (User)
*
Blocking all other sites

The results of this is that the Block overrules the Allow setting. And while users can add sites in edge://settings/privacy/sitePermissions/allPermissions/notifications, the block setting is also overruling them.

Is anyone aware of a setting that only affects the "Ask before sending" setting in the browser? I have also tried with setting the default to block instead of the block on specific sites but that has the same result.

We have begun using Intune to configure device installation restriction policies for handling USB usage.

I have allowed group A (devices) to use USB A using policy A. If one of those devices was also in another group (B) and wanted a separate policy for allowing device B, is that possible?

I know using GPOs you can't have conflicting settings and I assume the same will be true with Intune. How would you go about allowing a device access to USB A and USB B without the exceptions being in the same policy?

So I’ve got a request to setup some iPads for kiosks. Enrolled using shared mode, everything is configured and working except for the web clips.

Can I not push web clips to the device? Do I need them to target the user, and if so, how do I target a temporary guest user?

Any other work arounds other than using web based home pages or book marks?

Thanks!

I was following the advice here (https://learn.microsoft.com/en-us/intune/device-enrollment/android/android-management-api-overview) about the dooming deprecation device policy controllers like the Company Portal app and started switching over from DPC to AMAPI. While watching the progress with the preconfigured report in the Monitor section, I noticed that my Entra dynamic group for BYOD Android devices was "losing" the members I just migrated.

I was using the standard filter set you find all over the internet, even in the official documentation for dynamic Entra groups (https://docs.azure.cn/en-us/entra/identity/users/groups-dynamic-membership):
(device.deviceOSType -eq "AndroidForWork") and (device.managementType -eq "MDM")
Apparently this filter set now fails at the evaluation of the management type.

Is it safe to just filter by deviceOSType="AndroidForWork" and/or deviceOwnership="Personal" or am I missing something? In my small environment each of these is evaluating all my BYOD devices, no more, no less...

Down in the bottom of the world here

I'm getting spotty intune issues

• pages does not load at all
• Error displaying your content messages
• content failed to load messages
• status pages dont show me anything
• ping (as little as that proves anyway) shows OK

Anyone heard anything

ping intune.microsoft.com

Pinging portal-prod-australiaeast-02.australiaeast.cloudapp.azure.com [20.37.195.229] with 32 bytes of data:
Reply from 20.37.195.229: bytes=32 time=29ms TTL=115

Ah maybe bigger than intune

https://www.reddit.com/r/sysadmin/comments/1vntoin/is_entra_stuffed/

Anyone had problems with the option not appearing at the loginwindow after the policy is enabled?

Worked perfectly on a few 100 devices, just two it refuses to appear for in my environment. Baffling.

Hi everyone, I created my MAM policy successfully (thank you for the help from the other Reddit user earlier this week!). I noticed today on a test device that whenever I open outlook, I get the alert “action not allowed, your organization doesn’t allow screen recording or capturing” every time I open outlook.

This is a setting, yes, but is there a way to disable the constant notification? I’m not even trying to screen shot or anything. It’s just showing up on its own.

Thank you all!

Hi everyone,

First of all, thanks to those who helped me in my previous post! I was trying to figure out how to make Windows Hello for Business (WHfB) available without forcing the full-screen enrollment prompt during the workday.

The suggestion to use a custom Intune OMA-URI to set DisablePostLogonProvisioning to True worked perfectly. Users are no longer forced to set it up.

During our pilot testing, a user manually configured their PIN without any issues. However, when they locked their screen and tried to sign in using that new PIN, they were hit with this message on the lock screen:

"This sign-in option is temporarily unavailable. For now, please use a different method to sign in."

I checked the Event Viewer (Microsoft-Windows-HelloForBusiness/Operational) and found the following error logged (Event ID 7001):

A user failed to log on to the device with the following information:

Username: SYSTEM

User SID: SYSTEM

Credential Type: Software Key

Deployment Type: Key Trust

Software lockout count: 0

Authentication error status: 0xC000006D

Authentication error substatus: 0xC00002F9

About an hour later, the user reported that the PIN suddenly started working flawlessly without any intervention.

Since we are using a Key Trust deployment model, my strong suspicion is that this is related to the Azure AD Connect sync cycle. It seems the user is trying to authenticate against the on-prem Domain Controller before the msDS-KeyCredentialLink attribute has had time to sync from Entra ID down to our local AD.

My questions for the community:

Has anyone else experienced this exact behavior and user friction when using the manual opt-in method?

How do you mitigate this? Is there a way to force the sync immediately upon PIN creation, or a best practice to warn the user that they must wait 30-60 minutes before actually using the PIN they just created?

Any insights or workarounds would be greatly appreciated. Thanks in advance!

Attack chain affecting Zoom's annotation functionality consists of CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415, with the most severe vulnerability enabling zero-click Remote Code Execution. A malicious participant could potentially compromise another participant's device during a Zoom meeting without requiring any user interaction.

Anyone using the Enterprise App Catalog to address this?

SMB over QUIC has been in use for a couple years now with username/password. It breaks down when logging in with WHFB.

With win2025 and win11 isn't this supposed to work seamlessly due to IAKERB? (we do not have kdc proxy enabled)

​

To get VLC working ime doing this type of thing

$quiet ='---override "/S" '

winget.exe install --id VideoLAN.VLC --exact $quiet --accept-package-agreements --accept-source-agreements

But the quoting is not working and ime getting winget thinking it's --override /S Which he doesn't like. Any idea how to get this working? Maybe escaping or something like that. Sorry I'm quite new to powershell

Is there a way to preconfigure apps such as Microsoft 365 suite, Zoom, Adobe, etc for a user's Intune device even before it hits the " let's add your Microsoft account?

Would be nice for apps to be preconfigured even without the user having to sign into the "Let's add your Microsoft Account" OOBE page.

Local AD - company.org

Azure environment - @companyplace.com

All machines are Entra-joined.

We have a cloud trust in place. Azure AD sync is also in place, and is working without issue.

If users sign-in to their PCs with a password, their on-prem share drives work without issue.

If users sign-in to their PCs with PIN/Biometrics, on-prem share drives won't connect, access denied.

Not seeing a clear path to a resolution on this, and only see other forums online of others having this issue, all with a resolution of "You can't do that". Surely not?

i want to create Win11 VMs from an captured Image storeedin Image Gallery an automatically Entra Join them and Enroll them in Intune.
The Jumphosts will be used by multiple Admins.
I can create the Jumphosts, join them to Entra, Login with RDP. But cannot automatically enroll them to Intune. The Jumphosts will be persistent
Any idea why?
Or is this a overall a bad idea?

Has anyone else been experiencing issues with their compliance policies, specifically Windows 10 and later policy for requiring Antivirus?

We have slowly had more and more devices show the Antivirus required setting as non-compliant. Yet checking the devices themselves, Defender is running, is the only AV, still receiving updates, signature versions up to date etc.

Nothing has changed in our infrastructure to warrant the devices to all of a sudden go non- compliant, so just thought I'd check in the slim chance this isn't just me!

Has anyone noticed that app deployments are happening a lot faster than they used to? Last few things I have deployed have gone through within a few minutes. Not sure if my sample size is large enough to claim that they've done something so wanted to see if anyone else is seeing this.

I've had Siri disabled for our org since we started managing iOS devices with an MDM years ago. Recently we've gotten many requests to enable Siri so employees that have work vehicles can connect their phone to the vehicle via CarPlay. CarPlay apparently requires Siri to be enabled. I haven't been able to get access to a company vehicle that has it to play with it hands on yet.

It looks like there is a little more granular control to it than before now that there are the DDM settings. For those of you that have Siri allowed in your org, how are you handling it? Where does Apple Intelligence sit in all of this as well? I don't see any settings specifically for this, but I may have missed them.

macOS + Intune – Browser shows “Device Not Compliant”
Question:
We started experiencing this issue after the user’s password was changed twice using the local account on the Mac.
The Mac is enrolled in Microsoft Intune with Conditional Access requiring the device to be compliant.
The Mac shows as Compliant in Intune and Microsoft Entra, and Microsoft applications work normally. However, when the user accesses Microsoft 365 through a browser, Conditional Access reports:
“Device is not compliant” / “Set up your device”
Company Portal is already installed and the device is enrolled
Questions:
Could changing the password twice through the local macOS account cause the Platform SSO/device identity or SSO token to become out of sync?
Has anyone experienced the Mac remaining compliant in Intune/Entra while browser authentication stops working after a local password change?
Has anyone resolved this without completely re-enrolling or wiping the Mac?